FreePBX/framework

FreePBX/framework

www.freepbx.org

Releases1.74K

Frequency3 days 1 hour

Last Release about 1 month ago

Stars72

This module provides a facility to install bug fixes to the framework code that is not otherwise housed in a module

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-66039 ↗	Dec 9, 2025Tuesday, 9 December 2025, 22:16	9.8 CRITICAL	—
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
CVE-2025-59056 ↗	Sep 15, 2025Monday, 15 September 2025, 21:15	7.5 HIGH	—
FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.